Report a security concern privately
Keep vulnerabilities, credentials and sensitive reproduction details out of public channels.
Source 0.1.0 Private source package
Use a verified private route
Use the private security-reporting address below. Keep vulnerability reports separate from ordinary support questions and public issues.
Prepare only the information needed
Keep the affected source version, impact and minimal reproduction steps. Do not include live credentials, another person’s railway records or unnecessary personal data. Do not publish exploit details in a public issue.